Merge remote-tracking branch 'origin/master' into feat/certified-cross-tenant-worker-pool

tests/unit_tests/pipeline/test_legacy_config_migration.py

@@ -641,12 +641,40 @@ def test_dify_saved_timeout_is_not_blindly_activated(timeout):
     assert {'code': 'dify.timeout_default', 'field': 'ai.dify-service-api.timeout'} in result['warnings']
 
 
-@pytest.mark.parametrize('current', [None, '', False, [], 'plugin:bad', ' plugin:a/b/c', 'plugin:a/b/c/extra'])
+@pytest.mark.parametrize('current', [None, False, [], 'plugin:bad', ' plugin:a/b/c', 'plugin:a/b/c/extra'])
 def test_malformed_current_id_is_not_already_current(current):
     source = {'ai': {'runner': {'id': current}}}
     assert_block(plan(source), 'invalid_runner_id', 'ai.runner.id')
 
 
+@pytest.mark.parametrize('blank', ['', '   '])
+def test_blank_current_id_without_legacy_section_is_not_legacy(blank):
+    """A saved pipeline that simply has no runner selected is not legacy.
+
+    It has no legacy runner section to convert and no target to synthesize, so it
+    must report not_legacy instead of blocking the whole batch with a
+    malformed-id diagnostic.
+    """
+    source = {'ai': {'runner': {'id': blank, 'expire-time': 0}, 'runner_config': {}}}
+    result = plan(source)
+    assert result['state'] == 'not_legacy'
+    assert result['config'] is None
+    assert result['blockers'] == []
+    assert result['changed_paths'] == []
+    assert result['target_plugin'] is None
+
+
+def test_blank_current_id_with_legacy_section_stays_blocked():
+    """A blank id cannot silently coexist with a legacy section.
+
+    An unselected plugin runner plus a legacy section is an ambiguous state that
+    the operator must resolve, so it keeps the malformed-id blocker.
+    """
+    source = source_for()
+    source['ai']['runner'] = {'id': '', 'expire-time': 0}
+    assert_block(plan(source), 'invalid_runner_id', 'ai.runner.id')
+
+
 @pytest.mark.parametrize('runner', TARGETS)
 def test_deterministic_results_and_input_nonmutation_for_all_nine(runner):
     source = source_for(runner)

tests/unit_tests/plugin/test_certified_plugin_policy.py

@@ -10,27 +10,63 @@ from langbot_plugin.entities.io.context import PluginExecutionMode
 
 
 @pytest.mark.parametrize(
-    ('deployment', 'certificate', 'force', 'expected_disposition', 'expected_code'),
+    ('deployment', 'certificate', 'certificate_id', 'force', 'expected_disposition', 'expected_code'),
     [
-        ('cloud', ('valid', 'shared-runtime-v1'), False, 'shared_eligible', 'CERTIFIED_PLUGIN_SHARED_ELIGIBLE'),
-        ('cloud', ('absent', None), False, 'rejected', 'CERTIFIED_PLUGIN_CLOUD_CERTIFICATE_REQUIRED'),
-        ('cloud', ('malformed', None), False, 'rejected', 'CERTIFIED_PLUGIN_CLOUD_CERTIFICATE_INVALID'),
-        ('cloud', ('invalid', 'shared-runtime-v1'), True, 'rejected', 'CERTIFIED_PLUGIN_CLOUD_CERTIFICATE_INVALID'),
-        ('oss', ('absent', None), False, 'dedicated_allowed', 'CERTIFIED_PLUGIN_OSS_LEGACY_DEDICATED'),
-        ('oss', ('valid', 'shared-runtime-v1'), False, 'shared_eligible', 'CERTIFIED_PLUGIN_SHARED_ELIGIBLE'),
+        ('cloud', ('valid', 'shared-runtime-v1'), 'issuer', False, 'shared_eligible', 'CERTIFIED_PLUGIN_SHARED_ELIGIBLE'),
+        ('cloud', ('absent', None), None, False, 'rejected', 'CERTIFIED_PLUGIN_CLOUD_CERTIFICATE_REQUIRED'),
+        ('cloud', ('malformed', None), None, False, 'rejected', 'CERTIFIED_PLUGIN_CLOUD_CERTIFICATE_INVALID'),
+        (
+            'cloud',
+            ('invalid', 'shared-runtime-v1'),
+            'issuer',
+            True,
+            'rejected',
+            'CERTIFIED_PLUGIN_CLOUD_CERTIFICATE_INVALID',
+        ),
+        ('oss', ('absent', None), None, False, 'dedicated_allowed', 'CERTIFIED_PLUGIN_OSS_LEGACY_DEDICATED'),
+        ('oss', ('valid', 'shared-runtime-v1'), 'issuer', False, 'shared_eligible', 'CERTIFIED_PLUGIN_SHARED_ELIGIBLE'),
         (
             'oss',
             ('invalid', 'shared-runtime-v1'),
+            'issuer',
             False,
             'administrator_force_required',
             'CERTIFIED_PLUGIN_OSS_FORCE_REQUIRED',
         ),
-        ('oss', ('invalid', 'shared-runtime-v1'), True, 'dedicated_allowed', 'CERTIFIED_PLUGIN_OSS_FORCED_DEDICATED'),
+        (
+            'oss',
+            ('invalid', 'shared-runtime-v1'),
+            'issuer',
+            True,
+            'dedicated_allowed',
+            'CERTIFIED_PLUGIN_OSS_FORCED_DEDICATED',
+        ),
+        # A declaration the operator cannot resolve (no trusted key ring configured)
+        # must keep the OSS install working on the dedicated profile instead of
+        # blocking every certified marketplace package.
+        (
+            'oss',
+            ('invalid', 'shared-runtime-v1'),
+            None,
+            False,
+            'dedicated_allowed',
+            'CERTIFIED_PLUGIN_OSS_UNTRUSTED_DEDICATED',
+        ),
+        (
+            'oss',
+            ('invalid', 'shared-runtime-v1'),
+            None,
+            True,
+            'dedicated_allowed',
+            'CERTIFIED_PLUGIN_OSS_UNTRUSTED_DEDICATED',
+        ),
+        ('oss', ('malformed', None), None, False, 'dedicated_allowed', 'CERTIFIED_PLUGIN_OSS_UNTRUSTED_DEDICATED'),
     ],
 )
 def test_admission_policy_enforces_certification_matrix(
     deployment: str,
     certificate: tuple[str, str | None],
+    certificate_id: str | None,
     force: bool,
     expected_disposition: str,
     expected_code: str,
@@ -49,6 +85,7 @@ def test_admission_policy_enforces_certification_matrix(
         certificate=CertificateFacts(
             verification=CertificateVerification(verification),
             runtime_profile=runtime_profile,
+            certificate_id=certificate_id,
         ),
     )